CVE-2013-6396

Python Swift client is vulnerable to Missing SSL Certificate Check

5.8 MediumFix available

The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Exploit likelihood

0.73%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2013-6396
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6396
Updated: 2026-11-02

EUVDEUVD-2014-0093 No score

Record: EUVD-2014-0093
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p3xv-97g8-4wmj 9.3

Python Swift client is vulnerable to Missing SSL Certificate Check

The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Record: GHSA-p3xv-97g8-4wmj
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSVGHSA-p3xv-97g8-4wmj 9.3

Python Swift client is vulnerable to Missing SSL Certificate Check

Record: GHSA-p3xv-97g8-4wmj
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSV No score

Record: CVE-2013-6396
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-6396 No score

Record: DEBIAN-CVE-2013-6396
Updated: 2026-11-02

OSVPYSEC-2014-12 No score

Record: PYSEC-2014-12
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-6396 No score

Record: UBUNTU-CVE-2013-6396
Updated: 2026-11-02

Affected products

openstack swift

Affected packages

Affected packages
Package	Affected	Fixed
`python-swiftclient` PyPI	1.0 up to 2.0	2.0
`python-swiftclient` Debian:12	before 1:2.0.2-1	1:2.0.2-1
`python-swiftclient` Debian:13	before 1:2.0.2-1	1:2.0.2-1
`python-swiftclient` Debian:14	before 1:2.0.2-1	1:2.0.2-1
`python-swiftclient` PyPI	1.0 up to 2.0, plus listed versions 1.1.11.2.01.3.01.4.01.5.0 Show 4 moreShow less 1.6.01.7.01.8.01.9.0	2.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6396 is a medium vulnerability (CVSS 5.8) in Openstack Swift, published February 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in python-swiftclient 2.0.

References

Show 6 moreShow less